CVE-2022-31197 - SQL Injection vulnerability in org.postgresql:postgresql

[abstractj]

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to SQL Injection via the java.sql.ResultRow.refreshRow() function in jdbc/PgResultSet.java, due to insufficient escaping column names. An attacker with control of the underlying database can name a column with a string containing a semicolon or other statement terminator, then convince a user to run a query against the table with the compromised column, and then have the application run ResultSet.refreshRow(), to execute code.

NOTE:

• An application that only connects to its own database with a fixed schema with no DDL permissions is not affected by this vulnerability.
• Additionally, applications that do not invoke ResultSet.refreshRow() are not affected.

Remediation

Upgrade org.postgresql:postgresql to version 42.2.26, 42.4.1 or higher.

References

• GitHub Commit

[abstractj]

In order to update the postgresql dependency, we depend on https://github.com/keycloak/keycloak/issues/12210

[trixpan]

@abstractj wasn't this solved by https://github.com/keycloak/keycloak/pull/14006

?

[abstractj]

@trixpan that's correct, and thanks for bringing this to our attention.

[mikemicky4321]

Hello @abstractj and @trixpan, Could you please confirm in which version of Keycloak this issue was fixed?

[abstractj]

@mikemicky4321 Keycloak 20, please see the milestone.